CVSS: 7.2EPSS: 47%CPEs: 13EXPL: 1CVE-2022-22957 – VMware Workspace ONE Remote Code Execution
https://notcve.org/view.php?id=CVE-2022-22957
13 Apr 2022 — VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution. VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen dos vulnerabilidades de ejecución de código remota (CVE-2022-22957 y CVE-2022-22958). Un actor malicioso con acceso ad... • https://packetstorm.news/files/id/171918 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 79%CPEs: 13EXPL: 5CVE-2022-22960 – VMware Multiple Products Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-22960
13 Apr 2022 — VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'. VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen una vulnerabilidad de escalada de privilegios debido a permisos inapropiados en scripts de soporte. Un actor malicioso con acceso local puede escalar los privilegios a "root" VMware Workspace ONE Acce... • https://packetstorm.news/files/id/171935 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 12%CPEs: 63EXPL: 1CVE-2022-22948 – VMware vCenter Server Incorrect Default File Permissions Vulnerability
https://notcve.org/view.php?id=CVE-2022-22948
29 Mar 2022 — The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information. vCenter Server contiene una vulnerabilidad de divulgación de información debido a un permiso inapropiado de los archivos. Un actor malicioso con acceso no administrativo al vCenter Server puede explotar este problema para conseguir acceso a información confidencial VMware... • https://github.com/PenteraIO/CVE-2022-22948 • CWE-276: Incorrect Default Permissions •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22945
https://notcve.org/view.php?id=CVE-2022-22945
16 Feb 2022 — VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root. VMware NSX Edge contiene una vulnerabilidad de inyección de shell CLI. Un actor malicioso con acceso SSH a un dispositivo NSX-Edge puede ejecutar comandos arbitrarios en el sistema operativo como root • https://www.vmware.com/security/advisories/VMSA-2022-0005.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 165EXPL: 0CVE-2021-22050
https://notcve.org/view.php?id=CVE-2021-22050
16 Feb 2022 — ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests. ESXi contiene una vulnerabilidad de denegación de servicio HTTP POST lenta en rhttpproxy. Un actor malicioso con acceso a la red de ESXi puede explotar este problema para crear una condición de denegación de servicio al abrumar el servicio rhttpproxy con múltiples p... • https://www.vmware.com/security/advisories/VMSA-2022-0004.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.7EPSS: 0%CPEs: 171EXPL: 0CVE-2021-22041
https://notcve.org/view.php?id=CVE-2021-22041
16 Feb 2022 — VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. VMware ESXi, Workstation y Fusion contienen una vulnerabilidad de doble búsqueda en el controlador USB UHCI. Un actor malicioso con privilegios administrativos locales en una máquina virtual puede aprovechar este problema para ejecutar c... • https://www.vmware.com/security/advisories/VMSA-2022-0004.html •
CVSS: 6.7EPSS: 0%CPEs: 173EXPL: 0CVE-2021-22040
https://notcve.org/view.php?id=CVE-2021-22040
16 Feb 2022 — VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. VMware ESXi, Workstation y Fusion contienen una vulnerabilidad de uso de memoria previamente liberada en el controlador USB XHCI. Un actor malicioso con privilegios administrativos locales en una máquina virtual puede aprovechar este p... • https://www.vmware.com/security/advisories/VMSA-2022-0004.html • CWE-416: Use After Free •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22939
https://notcve.org/view.php?id=CVE-2022-22939
04 Feb 2022 — VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files. VMware Cloud Foundation contiene una vulnerabilidad de divulgación de información debido al registro de credenciales en texto plano dentro de varios archivos de registro en el SDDC Manager. Un actor... • https://www.vmware.com/security/advisories/VMSA-2022-0003.html • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 4%CPEs: 218EXPL: 0CVE-2021-22045 – VMware Workstation SCSI Heap-based Buffer Overflow Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-22045
04 Jan 2022 — VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine. VMware ESXi (versiones 7.0, 6.7 anteriores a ESXi670-202111101-SG y 6.5 anteriores a ESXi... • http://packetstormsecurity.com/files/165440/VMware-Security-Advisory-2022-0001.html • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 17%CPEs: 36EXPL: 1CVE-2021-21980
https://notcve.org/view.php?id=CVE-2021-21980
24 Nov 2021 — The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information. El cliente web de vSphere (FLEX/Flash), contiene una vulnerabilidad de lectura arbitraria de archivos no autorizada. Un actor malicioso con acceso a la red al puerto 443 en vCenter Server puede explotar este problema para conseguir acceso a información confidencial • https://github.com/Osyanina/westone-CVE-2021-21980-scanner •